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DETAILED ACTION 
Acknowledgements 

1 . Applicants' argument filed on October 8, 2007 is acknowledged. According 
claims 1-3, 5-33, and 35-66 remain pending. 

Terminal Disclaimer 

2. The terminal disclaimer filed on February 7, 2007 disclaiming the terminal portion 
of any patent granted on this application which would extend beyond the expiration date 
of Gavan et al U.S. Patent No. 7.117,191 B2 has been reviewed and is accepted. The 
terminal disclaimer has been recorded. 

Claim Rejections - 35 USC § 103 

3. The following is a quotation of 35 U.S.C. 103(a) which forms the basis for all 
obviousness rejections set forth in this Office action: 

(a) A patent may not be obtained though the invention is not identically disclosed or described as set 
* forth in section 102 of this title, if the differences between the subject matter sought to be patented and 
the prior art are such that the subject matter as a whole would have been obvious at the time the 
invention was made to a person having ordinary skill in the art to which said subject matter pertains. 
Patentability shall not be negatived by the manner in which the invention was made. 

Claim 28 , is rejected under 35 U.S.C. 103(a) as being unpatentable over 

Bowman U.S. Patent Application No. 5,627,886. 

As per claim 28 , Bowman discloses a system for monitoring one or more of a 
plurality of credit card or debit card networks, each network being configured to 
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generate network event records, each network event record being generated in 
response to an event occurring in the network, the system comprising: 

a fraud detection system including a core computing infrastructure (configurable 
software for configuring the disparate networks) and a domain specific infrastructure 
(configurable software or object oriented software for defining user specific data/rules), 
the domain specific infrastructure being dynamically reconfigurable in accordance with 
the domain specific implementation of the network being monitored, the core computing 
infrastructure being non-domain specific (configurable software for disparate networks), 
the fraud detection system being configured to analyze each network event record and 
perform a fraud prevention action in response to detecting an occurrence of fraud in the 
network event record and based on whether the network is a credit card network or 
debit card network (fig. 2; col. 2, lines 40-67; col. 3, lines 5-40; ...credit card/network...). 

Bowman failed to explicitly disclose the key phrases "core computing 
infrastructure", "domain specific infrastructure." However examiner have interpreted the 
phrases as shown in the brackets above. If the interpretation is correct then it would 
have been obvious to one of ordinary skill in the art at time of applicant's invention to 
modify the method of Bowman and incorporate a security system comprising core 
computing infrastructure, domain specific infrastructure in order to show detailed 
implementation of the fraud detection system. If the interpretation is not correct, then the 
phrase is subject to multiple interpretations and Applicant is required to clearly define 
what the phrases represent. 
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Claim Rejections - 35 USC § 103 

4. The following is a quotation of 35 U.S.C. 103(a) which forms the basis for all 
obviousness rejections set forth in this Office action: 

(a) A patent may not be obtained though the invention is not identically disclosed or described as set 
forth in section 1 02 of this title, if the differences between the subject matter sought to be patented and 
the prior art are such that the subject matter as a whole would have been obvious at the time the 
invention was made to a person having ordinary skill in the art to which said subject matter pertains. 
Patentability shall not be negatived by the manner in which the invention was made. 

Claims 1-3, 5-27, 29-33, and 35-66 , are rejected under 35 U.S.C. 103(a) as 

being unpatentable over Bowman U.S. Patent Application No. 5,627,886 in view of 

Phelps U.S. Patent No. 5,602,906. 

As per claim 1 , Bowman discloses a method for detecting fraud in one of a credit 
card or debit card system, the system generating network event records, each network 
event record being generated in response to an event in the system, the method 
comprising the steps of: 

(1) performing at least one fraud detection test on the network event records 
based on whether the system is a credit card system or a debit card system (see fig. 2; 
col. 2, lines 15-25, 40-50; col. 3, line 60-col..4, line 5; col. 17, lines 1-10... detecting 
network usage pattern indicative of fraud... credit card usage and authorization 
records...); 

(2) generating a fraud alarm upon detection of suspected fraud by the at 

least one fraud detection test (col. 2, lines 10-15, 25-40; col. 4, lines 25-35; col. 5, lines 
35-45; ...alarm generation...). 
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What Bowman does not explicitly teach is 

(3) correlating fraud alarms based on common aspects of the fraud alarms, the 
correlated fraud alarms being consolidated into a fraud case, the fraud case 

being assigned a priority based on a severity of the suspected fraud; and 

(4) responding to the fraud case with a fraud prevention action, the fraud 
prevention action being based on the priority assigned to the fraud case. 

Phelps discloses 

(3) correlating fraud alarms based on common aspects of the fraud alarms, the 
correlated fraud alarms being consolidated into a fraud case, the fraud case 

being assigned a priority based on a severity of the suspected fraud (col. 2, lines 30-40; 
col. 2, line 63-col. 3, line 5; col. 4, lines 40-50); and 

(4) responding to the fraud case with a fraud prevention action, the fraud 
prevention action being based on the priority assigned to the fraud case (col. 2, lines 
30-40; col. 2, line 63-col. 3, line 5). 

Accordingly it would have been obvious to one of ordinary skill in the art at time 
of applicant's invention to modify the method of Bowman and incorporate the method of 
(3) correlating fraud alarms based on common aspects of the fraud alarms, the 
correlated fraud alarms being consolidated into a fraud case, the fraud case 
being assigned a priority based on a severity of the suspected fraud; and (4) responding 
to the fraud case with a fraud prevention action, the fraud prevention action being based 
on the priority assigned to the fraud case in view of the teachings of Phelps in order to 
ensure that cases with high priority or severity level are given adequate attention and 
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proper resolution. 
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As per claims 2 and 32 , Bowman further discloses the method, wherein the 
method is performed by computer executable instructions disposed on at least one 
computer readable medium (fig 2). 

As per claims 3 and 33 , Bowman further discloses the method, wherein the 
computer executable instructions are distributed among a plurality of hardware 
platforms (fig. 2; col. 1, lines 45-60; col. 2, lines 25-40; ...detecting and monitoring 
disparate networks. . . ). 

As per claim 5 , Bowman further discloses the method, wherein at least a portion 
of the computer executable instructions are implemented in a core infrastructure (fig. 1; 
network backbone connecting disparate networks as in fig. 1). 

As per claim 6 , Bowman discloses the method, wherein the at least one fraud 
detection test includes the step of normalizing the network event record such that the 
network event records conforms to a predetermined format (col. 7, lines 5-15). 



As per claims 7 and 37 , Bowman further discloses the method, wherein the at 
least one fraud detection test includes the step of enhancing the network event record 
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such that an enhanced network event record includes data obtained from at least one 
external system (fig. 3; col. 6, lines 30-50; ...data incoming for fraud analysis...). 

As per claim 8 , Bowman further discloses the method, wherein the enhanced 
network event record includes data obtained from at least one database (fig. 2; col. 4, 
lines 50-60; ...RDBMS... primary database to store and maintain profile data etc.). 

As per claim 9 , Bowman further discloses the method, wherein the at least one 
database includes at least one of a configuration database, an event database, a billing 
database, a call history database, and/or a records database (fig. 2; col. 6, lines 5-30). 

As per claims 10 and 35 , Bowman further discloses the method, wherein the at 
least one fraud detection test includes a comparison of at least a portion of the network 
event records to a threshold rule, the alarm being generated if one network event record 
violates the threshold rule (col. 2, lines 25-40; compares statistics ...to predefined 
thresholds and responds with an alarm...). 

As per claims 11 and 44 , Bowman further discloses the method, wherein the 
alarm is generated if a value in one network event record exceeds a threshold value 
specified by the threshold rule (col. 2, lines 25-40; compares statistics ...to predefined 
thresholds and responds with an alarm...). 
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As per claim 12 , Bowman further discloses the method, wherein the alarm is 
generated if a value in the network event record does not equal a value specified by the 
threshold rule (col. 2, lines 25-40; compares statistics ...to predefined thresholds and 
responds with an alarm...). 

As per claim 13 , Bowman further discloses the method, wherein the at least one 
fraud detection test includes a comparison of at least a portion of the network event 
record to a profile detection rule, the alarm being generated if the network event record 
violates the profile detection rule (col. 2, lines 25-40; compares statistics ...to predefined 
thresholds and responds with an alarm...). 

As per claim 14 , Bowman further discloses the method, wherein the network 
event record is compared to a normal usage profile (col. 15, lines 40-65). 

As per claim 15 , Bowman further discloses the method, wherein the network 
event record is compared to a fraudulent usage profile (col. 15, lines 40-65). 

As per claim 16 , Bowman discloses the method, wherein the profile detection 
rule is based on historical network event records (col. 9, lines 10-35). 



As per claim 17 , Bowman further discloses the method, wherein the at least one 
fraud detection test includes a comparison of at least a portion of the network event 
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record to a predetermined pattern to identify a normal usage and/or a fraudulent usage 
(col. 15, lines 40-65). 

As per claim 18 , Bowman further discloses the method, wherein the 
predetermined pattern is based on call history data (col. 2, lines 40-50; ...usage 
pattern...). 

As per claim 19 . Bowman failed to explicitly disclose the method, wherein the 
predetermined pattern is generated by a neural network. Bowman however discloses 
that the system not only solves known fraud problems but also unknown fraud patterns. 

Phelps further discloses the method, wherein the predetermined pattern is 
generated by a neural network (col. 1, lines 15-20). 

Accordingly it would have been obvious to one of ordinary skill in the art at time 
of applicant's invention to modify the method of Bowman and incorporate method, 
wherein the predetermined pattern is generated by a neural network in view of the 
teachings of Phelps in order to ensure that system solves unforeseen cases of fraud by 
learning unknown patterns of fraud. 

As per claim 20 , Bowman further discloses the method, wherein the comparison 
is performed using tree-based algorithms that generate discrete output values (col. 7, 
lines 30-35). 
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As per claim 21 , Bowman further discloses the method, wherein the comparison 
is performed using statistical based algorithms that that employ iterative numerical 
processing techniques (col. 7, lines 30-35). 

As per claim 22 , Bowman further discloses the method, wherein the step of 
correlating includes the step of enhancing a network event record by obtaining relevant 
data from an external source (fig. 3; col. 6, lines 30.-50; ...data incoming for fraud 
analysis...). 



As per claim 23 . Bowman further discloses the method, wherein the step of 
correlating includes the step of applying at least one predetermined fraud analysis rule 
to the network event record to decide if a fraud case is appropriate (col. 13, lines 10-40). 

As per claim 24 , Bowman failed to explicitly disclose the method, wherein the 
step of correlating includes the step of applying at least one predetermined prioritization 
rule to the fraud case to obtain the priority of the fraud case. 

Phelps discloses the method, wherein the step of correlating includes the step of 
applying at least one predetermined prioritization rule to the fraud case to obtain the 
priority of the fraud case (col. 1, lines 45-60). 

Accordingly it would have been obvious to one of ordinary skill in the art at time 
of applicant's invention to modify the method of Bowman and incorporate the method 
wherein the step of correlating includes the step of applying at least one predetermined 



Application/Control Number: 10/627,033 Page 11 

Art Unit: 3621 

prioritization rule to the fraud case to obtain the priority of the fraud case in view of the 
teachings of Phelps in order to ensure that cases with high priority or severity level are 
given adequate attention and proper resolution. 

As per claim 25 , Bowman failed to explicitly disclose the method, wherein the 
fraud prevention action may be performed automatically, semi-automatically, or 
manually based on the priority. 

Phelps discloses the method, wherein the fraud prevention action may be 
performed automatically, semi-automatically, or manually based on the priority (fig. 2; 
col. 5, lines 60-67). 

Accordingly it would have been obvious to one of ordinary skill in the art at time 
of applicant's invention to modify the method of Bowman and incorporate the method 
wherein the fraud prevention action may be performed automatically, semi- 
automatically, or manually based on the priority in view of the teachings of Phelps in 
order to ensure that cases with high priority or severity level are given adequate 
attention and proper resolution. 

As per claims 26 and 65 , Bowman failed to explicitly disclose the method, 
wherein the fraud prevention action is selected from a group that is comprised of at 
least one of a card deactivation, a usage modification, an account deactivation, a range 
modification, and/or a privilege modification. 



Application/Control Number: 10/627,033 Page 12 

Art Unit: 3621 

Phelps further discloses the method, wherein the fraud prevention action is 
selected from a group that is comprised of at least one of a card deactivation, a usage 
modification, an account deactivation, a range modification, and/or a privilege 
modification (col. 1, lines 45-60; col. 4, lines 1-10; col. 5, lines 5-20). 

Accordingly it would have been obvious to one of ordinary skill in the art at time 
of applicants invention to modify the method of Bowman and incorporate the method 
wherein the fraud prevention action is selected from a group that is comprised of at 
least one of a card deactivation, a usage modification, an account deactivation, a range 
modification, and/or a privilege modification in view of the teachings of Phelps in order 
to show the various method employed to archive resolution. 

As per claim 27 and 66 , Bowman failed to explicitly discloses the method, 
wherein the alarm is selected from a group that is comprised of at least one of a pin 
hacking alarm, or a geographic alarm. However, Bowman does teach that the system 
responds with an alarm when a threshold is met or exceeded. 

Phelps also failed to explicitly designate its alarm as either pin hacking alarm or 
geographic alarm. Phelps teaches that an alert is generated when the threshold is 
exceeded. The threshold is dependent on the geographic dispersion of call origination 
point. 

Accordingly it would have been obvious to one of ordinary skill in the art at time 
of applicant's invention to modify the method of Bowman and incorporate the method 
wherein the alarm is selected from a group that is comprised of at least one of a pin 
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hacking alarm, or a geographic alarm in order to show the type of alarm designated or 
used. 



As per claim 29 , Bowman further discloses the system, wherein the fraud 
detection system is dynamically reconfigured to adjust fraud detection rules in 
accordance with changing patterns of fraud (col. 3, lines 5-15; ...detects new types of 
fraud...). 

As per claim 30 , Bowman further discloses the system, wherein the fraud 
detection system further comprises: 

a detection element coupled to the telecommunication system, the detection 
element being configured to generate a fraud alarm if the network event record is in 
violation of a predetermined fraud detection rule (col. 2, lines 25-40; compares statistics 
...to predefined thresholds and responds with an alarm...); 

an analysis element configured to receive fraud alarms from the detection 
element, the analysis element being configured to correlate fraud alarms having 
common aspects, and generate a fraud case based on correlated fraud alarms (col. 2, 
lines 25-40; compares statistics ...to predefined thresholds and responds with an 
alarm...). 

What Bowman does not explicitly teach is 

an expert element coupled to the analysis element, the expert element being 
configured to apply at least one predetermined expert rule to assign a priority 



Application/Control Number: 10/627,033 Page 14 

Art Unit: 3621 

to the fraud case, the expert element performing a fraud prevention action in 
accordance with the priority. 

Phelps discloses an expert element coupled to the analysis element, the expert 
element being configured to apply at least one predetermined expert rule to assign a 
priority to the fraud case, the expert element performing a fraud prevention action in 
accordance with the priority (col. 5, line 50-col. 6, line 25). 

Accordingly it would have been obvious to one of ordinary skill in the art at time 
of applicant's invention to modify the method of Bowman and incorporate the system 
wherein an expert element coupled to the analysis element, the expert element being 
configured to apply at least one predetermined expert rule to assign a priority 
to the fraud case, the expert element performing a fraud prevention action in 
accordance with the priority in view of the teachings of Phelps in to ensure that cases 
with highest priority is treated according to its priority or severity level. 

As per claim 31 Bowman failed to explicitly disclose the system, wherein the 
priority is based on a severity of suspected fraud. 

Phelps further discloses the system, wherein the priority is based on a severity of 
suspected fraud (col. 4, lines 1-10). 

Accordingly it would have been obvious to one of ordinary skill in the art at time 
of applicant's invention to modify the method of Bowman and incorporate the method 
wherein the priority is based on a severity of suspected fraud in view of the teachings of 
Phelps in order to ensure that cases with high priority or severity level are given 
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adequate attention and proper resolution. 
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As per claim 36 , Bowman further discloses the system, wherein the rules based 
thresholding engine further comprises: 

at least one rules database (fig. 2; col. 6, lines 30-35); 

a normalizer configured to configure the network event record in a standardized 
format (col. 7, lines 5-15; col. 8, lines 50-65; col. 9, lines 40-50); 

an enhancer component coupled to the normalizer, the enhancer component 
being configured to insert additional data in the network event record (col. 16, lines 40- 
55); and 

a threshold detector coupled to the enhancer component, the threshold detector 
being configured to compare a network event record to at least one threshold rule 
obtained from the at least one rules database, whereby the alarm is generated if 
the network event record violates the at least one threshold rule (col. 2, lines 25-40; 
compares statistics ...to predefined thresholds and responds with an alarm...). 

As per claim 38 , Bowman further discloses the system, wherein the network 
event record includes an event key and at least one feature, the event key identifying 
the network event and the at least one feature including event measurement data (col. 
2, lines 25-40). 



Application/Control Number: 1 0/627,033 Page 1 6 

Art Unit: 3621 

As per claim 39 , Bowman further discloses the system, wherein the 
measurement data includes a count of a number of occurrences of an event during a 
predetermined time period (col. 15, lines 55-65; col. 16, lines 40-65). 

As per claim 40 , Bowman further discloses the system, wherein the 
measurement data includes a count of a number of like events occurring simultaneously 
(col. 16, lines 40-60). 

As per claim 41 , Bowman further discloses the system, wherein the 
measurement data includes geographic velocity data (col. 16, lines 60-65). 

As per claim 42 , Bowman further discloses the system, wherein the at least one 
database comprises: 

an enhancement rules database coupled to the enhancer component, the 
enhancer component obtaining an enhancement rule from the enhancement rules 
database based on data in the network event record (fig. 2 and 3; col. 2, lines 40-64; 
"...including necessary billing information ..."); and 

a threshold detection rules database coupled to the threshold detector, the 
threshold detector obtaining a threshold rule in accordance with data in the network 
event record (fig. 2; col. 2, lines 25-40). 
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As per claim 43 , Bowman further discloses the system, wherein the 
enhancement rule directs the enhancer component to select external data from a 
selected external source (fig. 3; col. 6, lines 30-50; ...data incoming for fraud 
analysis...). 

As per claim 45 , Bowman further discloses the system, wherein the threshold 
rule stipulates that an alarm is generated when data in the network event record does 
not equal a threshold value (col. 2, lines 25-40; compares statistics ...to predefined 
thresholds and responds with an alarm...). 

As per claim 46 , Bowman further discloses the system, wherein the enhancer 
component provides the threshold detector with a feature vector, the feature vector 
including the event key and a plurality of feature event values, the event key including 
suspected fraud event identifying data, each feature event value of the plurality of 
feature event values providing fraud event measurement data (col. 2, lines 25-40). 

As per claim 47 , Bowman further discloses the system, wherein the feature 
event value includes a threshold value (col. 2, lines 25-40). 

As per claim 48 , Bowman further discloses the system, wherein the feature 
vector includes a name field, a value field, and a generating event field for each feature 
(col. 5, line 60-col. 5, line 5; ...event record is a collection of data fields...). 
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As per claim 49 , Bowman further discloses the system, wherein the feature 
vector is implemented as a data structure, the data structure being stored on a 
computer readable medium (col. 3, lines 15-25). 

As per claim 50 , Bowman further discloses the system, wherein the feature 
vector includes at least one contributing event field for each feature (col. 5, line 60-col. 
5, line 5). 

As per claim 51 Bowman further discloses the system, wherein the at least one 
software processing engine in the detection element further comprises: 

a profiling database including at least one profile detection rule (fig. 2; col. 4, 
lines 50-60); and 

a profiling engine configured to compare the network event record with at least 
one profile in accordance with the at least one profile detection rule, the profiling 
engine generating the alarm if the network event record substantially violates 
the profile detection rule (fig. 2; col. 2, lines 25-40). 

As per claim 52 , Bowman further discloses the system, wherein the profile 
includes a normal use profile and/or a fraudulent use profile (col. 4, lines 50-60). 
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As per claim 53 . Bowman further discloses the system, wherein the profile is 
based on historical network event records (col. 2, lines 10-15). 

As per claim 54 , Bowman further discloses the system, wherein the at least one 
software processing engine in the detection element comprises a pattern recognition 
engine configured to identify normal and/or fraudulent patterns of usage (col. 8, lines 
50-65). 

As per claim 55 , Bowman further discloses the system, wherein the pattern 
recognition engine compares the network event record to call history data obtained from 
a call history database (col. 8, lines 50-65; col. 9, lines 10-35). 

As per claim 56 , Bowman further discloses the system, wherein the pattern 
recognition engine includes a neural network configured to identify fraudulent patterns 
of usage (col. 8, lines 50-65). 

As per claim 57 . Bowman further discloses the system, wherein the pattern 
recognition engine includes tree-based algorithms (col. 7, lines 30-35). 

As per claim 58 , Bowman further discloses the system, wherein the pattern 
recognition engine includes statistical based algorithms that that employ iterative 
numerical processing techniques (col. 7, lines 30-35). 
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As per claim 59 , Bowman further discloses the system, wherein the analysis 
element further comprises: 

an external systems interface component configured to obtain data from external 
systems relevant to the fraud alarms (fig. 2 and 3); 

a configuration database configured to specify any additional data required for 
fraud alarm analysis (fig. 2); 

an alarm enhancement component coupled to the external systems interface and 
the configuration database, the alarm enhancement component being configured to 
add the additional data and external system data to the fraud alarm (fig. 3; col. 6, lines 
30-45); and 

a fraud case builder component coupled to the alarm enhancement component, 
the fraud case builder being configured to correlate and consolidate fraud alarms (col. 
10, line 10-25,40-55). 

As per claim 60 , Bowman further discloses the system, wherein the fraud case 
builder is coupled to a rules database, the rules database providing the fraud case 
builder with parameters for generating fraud cases (col. 10, line 10-25, 40-50). 

As per claim 61 , Bowman further discloses the system, wherein the expert 
element further comprises: 
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a configuration database configured to specify any additional data required for 
alarm analysis based on an alarm configuration (fig. 2); 

an external systems interface component configured to obtain data from external 
systems relevant to at least one of the alarms (fig. 3); 

a prioritizer component coupled to the configuration database and the external 
systems interface, the prioritizer being configured to direct the external system 
interface to obtain the additional data from at least one external system based 
on configuration data obtained from the configuration database, the prioritizer 
adding the additional data to the fraud case (fig. 3; col. 6, lines 20-30... obtains 
additional data at least from billings and according to customer selected criteria...). 
What Bowman does not explicitly disclose is priortizer. 

Phelps discloses a priortizer (col. 4, lines 1010) 

Accordingly it would have been obvious to one of ordinary skill in the art at time 
of applicant's invention to modify the method of Bowman and incorporate the method 
wherein there is a prioritizer component in view of the teachings of Phelps in order to 
ensure that cases are prioritized according to severity level so that adequate attention 
and proper resolution is given to such cases. 

As per claim 62 , Bowman failed to explicitly disclose the system, wherein the 
prioritizer component receives prioritization rules from the configuration database and 
prioritizes the fraud cases in accordance with the prioritization rules. 
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Phelps further discloses the system, wherein the prioritizer component receives 
prioritization rules from the configuration database and prioritizes the fraud cases in 
accordance with the prioritization rules (col. 4, lines 1010). 

Accordingly it would have been obvious to one of ordinary skill in the art at time 
of applicant's invention to modify the method of Bowman and incorporate the method 
wherein the prioritizer component receives prioritization rules from the configuration 
database and prioritizes the fraud cases in accordance with the prioritization in view of 
the teachings of Phelps in order to ensure that cases are prioritized according to 
severity level so that adequate attention and proper resolution is given to such cases. 

As per claim 63 , Bowman failed to explicitly disclose the system, wherein the 
prioritization rules specify the fraud prevention action. 

Phelps further discloses the system, wherein the prioritization rules specify the 
fraud prevention action (col. 5, lines 5-20; col. 6, lines 1-25). 

Accordingly it would have been obvious to one of ordinary skill in the art at time 
of applicants invention to modify the method of Bowman and incorporate the method 
wherein the prioritization rules specify the fraud prevention action in view of the 
teachings of Phelps in order to ensure that cases are prioritized according to severity 
level so that adequate attention and proper resolution is given to such cases. 



As per claim 64 , Bowman failed to explicitly disclose the system, further 
comprising an enforcement component coupled to the prioritizer component, the 
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enforcement component performing the fraud prevention action based on the enhanced 
fraud case. 

Phelps further discloses the system, further comprising an enforcement 
component coupled to the prioritizer component, the enforcement component 
performing the fraud prevention action based on the enhanced fraud case (col. 5, lines 
5-20; col. 6, lines 1-25). 

Accordingly it would have been obvious to one of ordinary skill in the art at time 
of applicant's invention to modify the method of Bowman and incorporate the system, 
further comprising an enforcement component coupled to the prioritizer component, the 
enforcement component performing the fraud prevention action based on the enhanced 
fraud case in view of the teachings of Phelps in order to ensure that cases are 
prioritized so that adequate attention and proper resolution is given to such cases. 

Response to Arguments 

5. Applicant's argument filed on October 8, 2007 have been fully considered but 
they are not persuasive. 

With respect to claim 28 , Applicant argues that Bowman, do not disclose or 
suggest the combination of features recited in claim 28. For example, Bowman does not 
disclose or suggest a fraud detection system configured to determine whether the 
network is a credit card network or a debit card network, to analyze each network event 
record, and to perform a fraud prevention action in response to detecting an occurrence 
of fraud in the network event record and based on the determination of whether the 
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network is a credit card network or a debit card network, as required by claim 28.. 
Instead, Bowman discloses a fraud detection system for detecting and preventing 
fraudulent use of communications or credit card/business networks (col. 2, lines 45-47). 
Indeed, the words "debit card" do not appear in Bowman. Nowhere in the allegation 
does the Examiner address a fraud detection system configured to determine whether 
the network is a credit card network or a debit card network, to analyze each network 
event record, and to perform a fraud prevention action in response to detecting an 
occurrence of fraud in the network event record and based on the determination of 
whether the network is a credit card network or debit card network, as required in claim 
28. 

In response, Examiner respectfully disagrees with Applicant's characterization of 
Bowman and submits that Bowman does disclose the claimed invention. Even by the 
Applicant's recitation of the cited portions of Bowman, it is clear that Bowman does 
disclose the features that Applicant argues are not disclosed. For example Bowman 
discloses that event detected include call details records from wireline, digital and 
analog cellular communication networks, or credit card usage and authorization 

records Yet Applicant argues that nowhere does Bowman disclose or suggest a 

method for detecting fraud in one of a credit card or debit card system determining 
whether the system is a credit card system or a debit card system, or performing at 
least one fraud detection test on the network event records based on the determination 
of whether the system is a credit card system or a debit card system, as required by 
claim 28. If the Bowman system does not determine the type of network, how then is it 



Application/Control Number: 10/627,033 Page 25 

Art Unit: 3621 

able to distinguish between a calling card and a credit card record in order to detect and 
prevent fraud? Applicant's line of argument is flawed because it is clear that Bowman 
discloses the claimed features. As discussed above calling card and credit card records 
are not the same but Bowman disclosure detects and prevents fraud in both networks. 
Therefore Bowman does determine the credit network from other networks. 
Furthermore it is not necessary that the word "debit card" appear in Bowman because 
the claim limitation is to determine whether the network is a credit card network or a 
debit card network, thus an alternative limitation . Since a determination is made and a 
credit card network is disclosed the limitation is satisfied. However, even if the limitation 
is not in the alternative, it would still be obvious to one of ordinary skill in the art 
because credit card and debit card use the same network for authorization purposes. 
Because Bowman does disclose a credit card network, detecting and prevent fraud 
based on the network event records on the credit card network, claim 28 is not 
patentable over Bowman. 

With respect to independent claim 1 , Applicant argues that Bowman and Phelps, 

if 

whether taken alone or in any reasonable combination, do not disclose or suggest the 
combination of features recited in claim 1. For example, Bowman does not disclose or 
suggest a method for detecting fraud in one of a credit card or debit card system, 
determining whether the system is a credit card system or a debit card system, or 
performing at least one fraud detection test on the network event records based on the 
determination of whether the system is a credit card system or a debit card system, as 
required by claim 1. Instead, Bowman discloses a fraud detection system for detecting 
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and preventing fraudulent use of communications or credit card/business networks (col. 
2, lines 45-47). Indeed, the words "debit card" do not appear in Bowman. Nowhere does 
Bowman disclose or remotely suggest a method for detecting fraud in one of a credit 
card or debit card system, determining whether the system is a credit card system or a 
debit card system, or performing at least one fraud detection test on the network event 
records based on the determination of whether the system is a credit card system or a 
debit card system, as required by claim 1. Nowhere in the allegation does the Examiner 
address determining whether the system is a credit card system or a debit card system , 
or performing at least one fraud detection test on the network event record based on the 
determination of whether the system is a credit system or a debit card system as 
required in claim 1. 

In response, Examiner respectfully disagrees and submits that Bowman and 
Phelps, taken together disclose all the features of the claimed invention as recited in 
independent claim 1. Even by the Applicant's recitation of the cited portions of Bowman, 
it is clear that Bowman does disclose the features that Applicant argues are not 
disclosed. For example Bowman discloses that event detected include call details 
records from wireline, digital and analog cellular communication networks, or credit card 
usage and authorization records.... Yet Applicant argues that nowhere does Bowman 
disclose or suggest a method for detecting fraud in one of a credit card or debit card 
system determining whether the system is a credit card system or a debit card system, 
or performing at least one fraud detection test on the network event records based on 
the determination of whether the system is a credit card system or a debit card system, 
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as required by claim 1. As discussed above calling card and credit card records are not 
the same but Bowman disclosure detects and prevents fraud in both networks. 
Therefore Bowman does determine the credit network from other networks. 
Furthermore it is not necessary that the word "debit card" appear in Bowman because 
the claim limitation is to determine whether the network is a credit card network or a 
debit card network, thus an alternative limitation . Since a determination is made and a 
credit card network is disclosed the limitation is satisfied. Applicant's argument is flawed 
because it is clear that Bowman discloses the claimed features. It appears that 
Applicant will not be satisfied until the word determining appears in Bowman disclosure. 
However, it is Examiner's principle position that such disclosure is not necessary. Again, 
even if the limitation is not in the alternative, it would still be obvious to one of ordinary 
skill in the art because credit card and debit card use the same network for authorization 
purposes. 

Applicant further argues that the recitation of determining whether the system is a 
credit card system or a debit card system is not in the alternative and nowhere does 
Bowman disclose such feature. 

In response, the recitation is in the alternative because once the reference 
discloses one or the other, i.e. credit card system or debit card system, such disclose 
will be sufficient to reject the claimed limitation because it is either a debit card system 
or a credit card system and not both. Besides, what is the difference between a credit 
card network and a debit card network for purposes of detecting and preventing fraud? 
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Applicant further argues that Examiner's motivation statement that it would have 
been obvious to one of ordinary skill in the art because credit card and debit card use 
the same network for authorization purposes is merely a conclusory statement that 
completely lacks support in Bowman. Such motivation statements are insufficient for 
establishing a prima facie case of obviousness. In support, Applicant relied upon KSR 

International Co. v. Teleflex Inc., 550 U.S. (April 30, 2007) (citing In re Kahn, 441 

F.3d 977, 988 (Fed. Cir. 2006)), where it was held that rejections on obviousness 
grounds cannot be sustained by mere conclusory statements; instead, there must be 
some articulated reasoning with some rational underpinning to support the legal 
conclusion of obviousness. 

In response, Examiner respectfully disagrees and submits that KSR instead 
forecloses the argument that a specific teaching, suggestion, or motivation is required to 
support a finding of obviousness. See the recent Board decision Ex parte Smith. — 
USPQ2d— slip op. at 20, (Bd. Pat. App. & Interf. June 25, 2007) (citing KSR, 82 
USPQ2d at 1396). 

Nevertheless and as argued in prior office actions in response to applicant's 
argument that there is no suggestion to combine the references, the examiner 
recognizes that obviousness can only be established by combining or modifying the 
teachings of the prior art to produce the claimed invention where there is some 
teaching, suggestion, or motivation to do so found either in the references themselves 
or in the knowledge generally available to one of ordinary skill in the art . See In re Fine, 
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837 F.2d 1071, 5 USPQ2d 1596 (Fed. Cir. 1988) and In re Jones, 958 F.2d 347, 21 
USPQ2d 1941 (Fed. Cir. 1992). 

To this end, the Examiner recognizes that references cannot be arbitrarily altered 
or modified and that there must be.some reason why one skilled in the art would be 
motivated to make the proposed modifications. Although the motivation or suggestion to 
make modifications must be articulated, it is respectfully submitted that there is no 
requirement that the motivation to make modifications must be expressly articulated 
within the references themselves. References are evaluated by what they suggest to 
one versed in the art, rather than by their specific disclosures, In re Bozek, 163 USPQ 
545 (CCPA 1969). The Examiner is concerned that the Applicant apparently ignores the 
mandate of the numerous court decisions supporting the position given above. The 
issue of obviousness is not determined by what the references expressly state but by 
what they would reasonably suggest to one of ordinary skill in the art, as supported by 
decisions in In re De/isle 406 Fed 1326, 160 USPQ 806; In re Kell, Terry and Davies 
208 USPQ 871; and In re Fine, 837 F.2d 1071, 1074, 5 USPQ 2d 1596, 1598 (Fed. Cir. 
1988) (citing In re Lalu, 747 F.2d 703, 705, 223 USPQ 1257, 1258 (Fed. Cir. 1988)), 
and of course the recent KSR decision. 

In the instant case and as argued in prior actions, the Examiner respectfully 
notes that each and every motivation to combine the applied references is accompanied 
by select portions of the respective references which specifically support that particular 
motivation. As such, it is NOT seen that the Examiner's combination of references is 
unsupported by the applied prior art of record. Rather, it is respectfully submitted that 
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explanation based on the logic and scientific reasoning of one ordinarily skilled in the art 
at the time of the invention that support a holding of obviousness has been adequately 
provided by the motivations and reasons indicated by the Examiner, Ex pane 
Levengood 28 USPQ 2d 1300 (Bd. Pat App. & Inter, 4/22/93). The Examiner stated 

that the motivation was because of security by ensuring that cases with high priority or 

severity level are given adequate attention and proper resolution (both Bowman and 
Phelps disclose detecting fraudulent network usage pattern and methods of resolutions 
(see abstracts of both arts)). What other motivation does Applicant want in order for the 
two references to be combinable? 

Applicant further argues that Examiner's purported motivation to combine is 
based on impermissible hindsight. 

In response and as argued in prior actions to applicant's argument that the 
examiner's conclusion of obviousness is based upon improper hindsight reasoning, it 
must be recognized that any judgment on obviousness is in a sense necessarily a 
reconstruction based upon hindsight reasoning. But so long as it takes into account 
only knowledge which was within the level of ordinary skill at the time the claimed 
invention was made, and does not include knowledge gleaned only from the applicant's 
disclosure, such a reconstruction is proper. See In re McLaughlin, 443 F.2d 1392, 170 
USPQ 209 (CCPA 1971). 

Applicant further argues that the screening means of Bowman does not disclose 
or suggest performing at least one fraud detection test on the network event records 
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based on the determination of whether the system is a credit card network or a debit 
card network. 

In response, Examiner disagrees and submits that Bowman, in addition to the 
discussion above does disclose a screening means by which call event records are 
screened. A screening is a test applied to one field in a call event. Bowman's Fraud 
Management System support variety of types of screening including list , range , pattern 
etc. Because Bowman discloses a credit card system as shown in the Applicant recited 
portions of Bowman, Bowman does disclose the claimed limitation as shown in the 
rejections. Thus claim 1 is not patentable over Bowman in view of Phelps. 

With respect to claims 2, 3 and 5-27 , Applicant argues that these claims depend 
from claim 1 and are therefore patentable over Bowman and Phelps, whether taken 
alone or in any reasonable combination, for at least the reasons given with regard to 
claim 1 . 

In response, Examiner disagrees and submits that claims 2, 3 and 5-27 are not 
patentable over Bowman and Phelps either because they depend from claim 1 or for 
their own individual merits. 

With respect to claims 29-33 and 35-66 , Applicant argues that these claims 
depend from claim 28 and are therefore patentable over Bowman and Phelps, whether 
taken alone or in any reasonable combination, for at least the reasons given with regard 
to claim 28. 
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In response, Examiner disagrees and submits that claims 29-33 and 35-66 are 
not patentable over Bowman and Phelps either because they depend from claim 1 or for 
their own individual merits. 



Conclusion 

6. THIS ACTION IS MADE FINAL. Applicant is reminded of the extension of time 
policy as set forth in 37 CFR 1 .1 36(a). 

A shortened statutory period for reply to this final action is set to expire THREE 
MONTHS from the mailing date of this action. In the event a first reply is filed within 
TWO MONTHS of the mailing date of this final action and the advisory action is not 
mailed until after the end of the THREE-MONTH shortened statutory period, then the 
shortened statutory period will expire on the date the advisory action is mailed, and any 
extension fee pursuant to 37 CFR 1.136(a) will be calculated from the mailing date of 
the advisory action. In no event, however, will the statutory period for reply expire later 
than SIX MONTHS from the mailing date of this final action. 

Examiner's Note: Examiner has cited particular columns and line numbers in 
the references as applied to the claims below for the convenience of the applicant. 
Although the specified citations are representative of the teachings in the art ad are 
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applied to the specific limitations within the individual claim, other passages and figures 
may apply as well. It is respectfully requested that the applicant, in preparing the 
responses, fully consider the references in entirety as potentially teaching all or part of 
the claimed invention, as well as the context of the passage as taught by the prior art or 
disclosed by the examiner. 

Any inquiry concerning this communication or earlier communications from the 
examiner should be directed to Charles C. Agwumezie whose number is (571) 272- 
6838. The examiner can normally be reached on Monday - Friday 8:00 am - 5:00 pm. 

If attempts to reach the examiner by telephone are unsuccessful, the examiner's 
supervisor, James Trammell can be reached on (571) 272 - 6712. 

Any inquiry concerning this communication or earlier communications from the 
examiner should be directed to Charles C. Agwumezie whose number is (571) 272- 
6838. The examiner can normally be reached on Monday - Friday 8:00 am - 5:00 pm. 

If attempts to reach the examiner by telephone are unsuccessful, the examiner's 
supervisor, Andrew Fischer can be reached on (571) 272 - 6779. 

Information regarding the status of an application may be obtained from the 
Patent Application Information Retrieval (PAIR) system. Status information for published 
applications may be obtained from either Private PAIR or Public PAIR. Status 
information for unpublished applications is available through Private PAIR only. For 
more information about the PAIR system, see http://pair-direct.uspto.gov . Should you 
have questions on access to the Private PAIR system, contact the Electronic Business 
Center (EBC) at 866-217-9197 (toll free). If you would like assistance from a USPTO 



Application/Control Number: 1 0/627,033 Page 34 

Art Unit: 3621 

Customer Service Representative or access to the automated information system, call 
800-786-9199 (IN USA OR CANADA) or 571-272-1000. 



Charlie Lion Agwumezie 
Patent Examiner 
Art Unit 3621 

November 15, 2007. Q^\jjCcL>^~ ^ l^K. 



